540354b383dd0f885b821b89177234fc062b7d6ae69fa082b120f1b33e510f51

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02dfb5306108a08bfa999d05b7c78752_JaffaCakes118.html
Size

55KB
MD5

02dfb5306108a08bfa999d05b7c78752
SHA1

1021271008899ab35c431ac48f85c383e9733190
SHA256

540354b383dd0f885b821b89177234fc062b7d6ae69fa082b120f1b33e510f51
SHA512

0ace4798630656b4206dd70e70851339c6362f0ecd6daea6f75df80857ae3b706a8d3cae8e1819f8b1d5220800dd1b1dd1a92b617b3031b1a061fabd64957508
SSDEEP

768:SuuTWfo7doOv+sgsnAEXdc8PNZNKoKVeeePsgsCdscI4Q:SuehmVeeePsghQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d19dc26c13db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433885414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002c2b6be0ac419b49b8e207505c83f1c8537ca06e55c5f511b40f788158c91d56000000000e800000000200002000000023f77ea8af6a108b6e895c82437640d4eaa36148c80d767f7c4ccc94495c7d4720000000246fc19b8205ab60845c97163c03f15a38c26d852145a3b0ab01bf6bdda514e4400000005762b5b28cc26579a91cb80050fbc677ce87d9aee823d9a930b315e1b23af5109e4ad47049480c648b8ce6318a55037a64ba6b598ba5f607dece5c6a4f8fb9e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000566ae37e7c35b6d678da2d6d6a3aa624c9a810820158d64331aa08047fc24207000000000e8000000002000020000000e1ca79cfe98bcad4736ee9a2691f330eebed7f1ae1ac396d8c8abcbfa6165d85900000001e071586966d7f903fa21bdc65de1ca43cf4c1896bb1f224055719ebc5db2317e91e8083035b0aaa64eff7d2134114337fba8e474b775bf70ad37569f91340fad72ab142c9711c7b03ae8454f603b865ca3336fe1e06d1511f99879752cad42b1338373846578345fa40a4564cc7cc2452247eb598ff03199d59f630e3651bec8fc3943e58736e8c7213df8c80edff7d4000000075d217e895e36ffd30d8d847dee582d982f046012fdabf477e6ecbe7aee79ee279d0255a134179fcd9561981093a9b8c8267e89a8d0c1a52849b4009635abff6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED5DB201-7F5F-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2656	2668	iexplore.exe	31
PID 2668 wrote to memory of 2656	2668	iexplore.exe	31
PID 2668 wrote to memory of 2656	2668	iexplore.exe	31
PID 2668 wrote to memory of 2656	2668	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02dfb5306108a08bfa999d05b7c78752_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b27c18a5bdaa3875b9a414c97741c550

SHA1
62e16a22fd1d7057ccbccdfc63fd946fdc830de6

SHA256
955fc2185c007c0533fb4946fa9dd52e018022eeab4c5c9d1111698192069d66

SHA512
fa31b5a47de0f2c594001dbdc3ee54d1c587c3f31061e4f33c795a5d18d6dd72a91e7c8027bf1e88c196cc91f292d950c44dabfd37543fa4ad4c41e6babd3e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
997a78f293627b42dcbfcbaa5a20428d

SHA1
177184744b3e81cf26f33425757bed0887dfa3ca

SHA256
7421e7419a01c56c398f6e7864ebb0f3d06992cab0fefec4716b578a6c2d6602

SHA512
4f66e82d6c335aceda216f14af349c0a31d435a26ea47589ffb682feb78924f2734befdd4101160d62e8c1b4225ef935c8c5cfa32243f4740a6c0558cdccb030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5891cfd00c6827322b91ebd5cdc2b955

SHA1
8d500f7952b754eff4dc682163f4173115c9215a

SHA256
fad696494edf67b44b2fa3e5ed93be308f92bff8bd1333ae8db4710a5056f241

SHA512
d35cd60c75338daa5627f58f2d54d5ea9baf890a349cce77bfbbee37c14925ad93892948a5e26218a77fb7c542051c9c71e406d95d2bf6ecd872c5640a76ba3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f539d91b6d0366fcb2e3d451e4a9957

SHA1
536b22def521d15ca721023197037980be9beee5

SHA256
657ec15d98f5d200321e873f1a1ad6d9e5e9e2146e6734c62b072978309b0ccf

SHA512
521364862aabae5d12501e38c89a88734641e58710ca700eb1b377d90a8c2fc25c55ab75ffe20ec7372723d4c899bcd5dcf02fb9e79b31914bc2b35a4f3865fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db69e1b6ab068cde0e0713104395067b

SHA1
3b4a0a601232fffaecdc12f1b832a3b18496c409

SHA256
a5c267066876d5ed0602b1098cd5ae33c385ee41b562bf75de0b4fc85cfccf79

SHA512
26b8cc7ad70e9cb8f8623cd5b9dc7524ff2930b7df9751deaa481b99b02e07f2924351ffac8ffbcdb7dcaa11dcc62d7b767cf14c1745c293d1e112946fd65c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca980eaa7646c3fc924d70a784dd48e2

SHA1
63d37c58d64b4aa5451b0facad6fa11051b38d02

SHA256
15cb7ba2cbeb1f147ddd2199ddb5d3289a40f3ca105fe2397bebf0160c9d2463

SHA512
d2ca7a174f5f63fec5b88deaf9582b3db97160d3f403f5d0a5f23f9494c2bc17e019a6876dd6fd7c1044adcd27fbe90fa9acffc9c5281c80dde58d21d383637e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
701a0b25784236f7d116d178c2f42f1d

SHA1
8a687600cc5845f26a50625c699b9a957da430f8

SHA256
d63068d3a34d6cfb3d94dd851d7a281895396640fa41ab7f9d156a0319d02f27

SHA512
c983f4f5e8b791c65be5012df2afd3bc6a668f459644c0921679c2c3677c5cba740d240b7e49669aa71b99908afe1e581af57b520cd6a06fc2ff07c6fce1f8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0c9d58478a24a9a70d4bb4a7011ed18

SHA1
d46d8a5bdc51d095024de2613e58bedcce52a87c

SHA256
e2eed12784e3b7789883d0cc604078190bb8f83a64d88d50b314e0f8c7463d29

SHA512
7798a0025a64590ff30ccee82c789b2aa26f13639721004587389cf78497bfbb3bd4393179f5e735b9749096c5d5b519c88fd5524ed68abb06399d8cbd9c9900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d27df7ec1258c9f763616442c70a6c0

SHA1
17026123a6c92f0ae016642befbc0a7ae89b1fd2

SHA256
bb0ef8e0fae5ba1d6be17535516b81b39037b0caad7174f120a76e7aec69b3b1

SHA512
dbeac61aced156806a7a11560b7afde5dce026175849adc7e08be3922165728e4afc9353e669ca26fe02a9521bfc8ca9dec662f1283139462c09b7c78401823e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit